CVE-2026-26023: Dify LLM Platform XSS Vulnerability

CVE-2026-26023 Overview

CVE-2026-26023 is a Cross-Site Scripting (XSS) vulnerability discovered in Dify, an open-source LLM (Large Language Model) application development platform. The vulnerability exists in the web application chat frontend when using ECharts for data visualization. Prior to version 1.13.0, user or LLM inputs containing ECharts data with specific JavaScript payloads are executed without proper sanitization, allowing attackers to inject and execute arbitrary JavaScript code in victims' browsers.

Critical Impact

Attackers can inject malicious JavaScript through ECharts inputs in the chat interface, potentially leading to session hijacking, credential theft, or malicious actions performed on behalf of authenticated users interacting with Dify-powered applications.

Affected Products

• Dify versions prior to 1.13.0
• Dify web application chat frontend with ECharts integration
• Self-hosted and cloud-deployed Dify instances using vulnerable versions

Discovery Timeline

• February 11, 2026 - CVE-2026-26023 published to NVD
• February 12, 2026 - Last updated in NVD database

Technical Details for CVE-2026-26023

Vulnerability Analysis

This Cross-Site Scripting vulnerability (CWE-79) occurs in Dify's web chat frontend when processing ECharts visualization data. ECharts is a popular JavaScript charting library that supports dynamic content rendering, including event handlers and formatter functions. The vulnerability arises because the Dify chat interface fails to properly sanitize or restrict JavaScript execution within ECharts configuration objects before rendering them in the user's browser.

When users interact with LLM-powered applications built on Dify, the chat interface can display rich content including charts. An attacker can craft malicious ECharts configuration payloads that contain embedded JavaScript. When this payload is processed by the frontend, the malicious JavaScript executes in the context of the victim's browser session.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization in the ECharts rendering pipeline. The Dify frontend does not adequately filter or escape JavaScript code embedded within ECharts configuration objects received from user inputs or LLM responses. ECharts supports callback functions in various configuration options such as formatter, tooltip, and event handlers, which can be abused to execute arbitrary JavaScript.

Attack Vector

The attack leverages network-accessible chat functionality with user interaction required. An attacker can exploit this vulnerability through several vectors:

1. Direct User Input: An attacker could craft a message containing a malicious ECharts payload in systems where user inputs are rendered as charts
2. LLM Response Manipulation: Through prompt injection techniques, an attacker could manipulate an LLM to generate responses containing malicious ECharts configurations
3. Stored XSS: If malicious payloads are stored and later rendered to other users, this becomes a stored XSS vulnerability affecting all users who view the content

The vulnerability requires user interaction—a victim must view the malicious content in their browser for the JavaScript payload to execute. Once executed, the attacker's JavaScript can access cookies, session tokens, and perform actions as the authenticated user.

Detection Methods for CVE-2026-26023

Indicators of Compromise

• Unusual JavaScript execution patterns in browser console logs when viewing Dify chat interfaces
• Network requests to unexpected external domains originating from Dify chat pages
• Suspicious ECharts configurations containing callback functions or inline JavaScript in stored chat data
• User reports of unexpected browser behavior or redirects when using Dify applications

Detection Strategies

• Implement Content Security Policy (CSP) monitoring to detect unauthorized script execution attempts
• Review server-side logs for chat messages containing ECharts configurations with JavaScript keywords such as function, eval, script, or event handlers
• Deploy web application firewalls (WAF) with XSS detection rules to identify malicious payloads in requests
• Enable browser developer tools monitoring during security testing to identify unexpected script execution

Monitoring Recommendations

• Configure alerting for CSP violation reports indicating inline script execution attempts
• Monitor for unusual patterns in chat content containing ECharts-related JSON structures
• Implement anomaly detection for chat sessions that generate unexpected network requests
• Review application logs for repeated attempts to inject special characters or JavaScript syntax

How to Mitigate CVE-2026-26023

Immediate Actions Required

• Upgrade Dify to version 1.13.0 or later immediately to address this vulnerability
• Review chat logs and stored content for any evidence of exploitation attempts prior to patching
• Implement a Content Security Policy (CSP) that restricts inline script execution as a defense-in-depth measure
• Audit any user-generated or LLM-generated content that may have been stored and could contain malicious payloads

Patch Information

The vulnerability has been addressed in Dify version 1.13.0. The fix implements proper sanitization of ECharts configuration data to prevent JavaScript execution from untrusted inputs. Organizations should upgrade to this version or later to remediate the vulnerability.

For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-qqjx-5h5w-x5vj. The specific commit addressing this vulnerability can be reviewed at GitHub Commit 378a1d7d, and the patched release is available at Dify Release 1.13.0.

Workarounds

• If immediate upgrade is not possible, consider disabling ECharts functionality in the chat frontend until the patch can be applied
• Implement server-side content filtering to strip or reject ECharts configurations containing JavaScript functions or event handlers
• Deploy a reverse proxy or WAF rule to block requests containing suspicious JavaScript patterns in chat payloads
• Restrict access to Dify applications to trusted users only until the vulnerability is remediated

# Example: Implementing a Content Security Policy header in nginx
# Add to your Dify nginx configuration
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self';" always;